Today we released Security Advisory 2749655 to alert customers to a clerical error made in code-signing a number of recently released security updates. This error will cause the digital signature to expire and become invalid prematurely – not a securit…
I’ve heard of these tools and from what I understand, they just send tons of random data at different services and observe their reaction to it.
What is the purpose of a fuzzer? How can it be applied during a pentest?
What is the opinion of scholars, cryptographers on NSA Suite A? Containing unpublished algorithms. Could it really be that much better than the published algorithms besides being obscure and not documented publicly?
Today, we revised Security Advisory 2757760 with two new pieces of information:
A Fix It solution is available to address the vulnerability via an app-compat shim The comprehensive security update will be released out-of-band on Friday. In this blog po…
I’m thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user’s Windows password as part of the encryption process. Now, I’ve heard that there are tools …
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-30#section-10.12 says:
The client MUST implement CSRF protection […] typically accomplished by requiring any request sent to the redirection URI endpoint to include a value that …
SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as users, or the providers themselves, dete…
Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater?
Per my understanding, if somebody is phishing your users, it’s also trivial for them to proxy requests …
I’m trying to figure out the best practices for accessing my dev box from a public terminal.
Most sources I’ve found recommend protecting the box with some kind of two factor authentication, such as adding a command= prefix to the authoriz…
MS-CHAP is the Microsoft version of the Challenge-Handshake Authentication Protocol and is described in RFC2759. A recent presentation by Moxie Marlinspike [1] has revealed a breakthrough which reduces the security of MS-CHAPv2 to a single DES encrypti…
